67 lines
1.8 KiB
Go
67 lines
1.8 KiB
Go
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
package detectors
|
|
|
|
import (
|
|
"fmt"
|
|
"strconv"
|
|
"strings"
|
|
|
|
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
|
|
)
|
|
|
|
func stdioSocketInode(process model.Process) *int {
|
|
// The Python oracle checks descriptors in 0,1,2 order and stops at the
|
|
// first socket. That ordering avoids a map-iteration-dependent alert.
|
|
for _, fd := range []string{"0", "1", "2"} {
|
|
target := process.FDTargets[fd]
|
|
if strings.HasPrefix(target, "socket:[") && strings.HasSuffix(target, "]") {
|
|
value, err := strconv.Atoi(target[8 : len(target)-1])
|
|
if err == nil {
|
|
return &value
|
|
}
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func optionalPythonInt(value *int) string {
|
|
// Python f-strings render a missing optional integer as "None". Keys are
|
|
// stable machine contracts, so preserve that spelling rather than Go's
|
|
// default <nil> representation.
|
|
if value == nil {
|
|
return "None"
|
|
}
|
|
return strconv.Itoa(*value)
|
|
}
|
|
|
|
func optionalDisplayInt(value *int) string {
|
|
// Human-facing stealth-network details use "?" for unknown ownership even
|
|
// though the corresponding dedup key uses Python's "None" spelling.
|
|
if value == nil || *value == 0 {
|
|
return "?"
|
|
}
|
|
return strconv.Itoa(*value)
|
|
}
|
|
|
|
func alertPIDs(value *int) []int {
|
|
if value == nil || *value == 0 {
|
|
return []int{}
|
|
}
|
|
return []int{*value}
|
|
}
|
|
|
|
func truncateRunes(value string, limit int) string {
|
|
// Python slices Unicode code points, not UTF-8 bytes. Rune truncation keeps
|
|
// command details identical for non-ASCII argv values.
|
|
runes := []rune(value)
|
|
if len(runes) <= limit {
|
|
return value
|
|
}
|
|
return string(runes[:limit])
|
|
}
|
|
|
|
func socketKey(kind string, socket model.Socket) string {
|
|
return fmt.Sprintf("stealthnet:%s:%s:%s:%s",
|
|
kind, optionalPythonInt(socket.PID), socket.Local, socket.Peer)
|
|
}
|